Improved session system

* Use UUID4s as session_keys
* Use HMAC to calculate the session_hash
* Allow setting "permanent" cookies